1. Who we are
1.1This notice explains how personal data is handled when you use the website at worldkbn.com, the national branch pages, KBN Social, the fighter portal, the officials' tools and the KBN app (the "Service"), and when you take part in the KBN World Ranking or in KBN-sanctioned events.
1.2The controller responsible for your personal data is the KBN World Federation of Martial Arts, operated through [to be confirmed] (registered number [to be confirmed]; registered address [to be confirmed]). In this notice "KBN", "we" and "us" mean that controller.
1.3Contact for all data-protection matters: holdingkbn@gmail.com (please mark your message "Data protection"). We have not appointed a statutory Data Protection Officer; the need for one, and for a UK or EU representative if the controller is not established in the UK or EU, is [to be confirmed].
1.4The Service is built and technically operated for KBN by HBZ Group, which acts on KBN's instructions as a processor. The precise contractual roles are [to be confirmed].
↑ Contents2. The data we process and why
2.1The table below lists the categories of personal data we process, what we use them for and the lawful basis under Article 6 UK GDPR (and, for special category data, the condition under Article 9). Where we rely on legitimate interests, the interest is stated. You can ask us for our legitimate-interests assessments.
| Who / data | Examples | What we use it for | Lawful basis |
|---|---|---|---|
| Athletes — application and identity | Name, date of birth, nationality, gender, passport or national ID number (encrypted), phone, e-mail, address, club, coach, discipline, weight, height, reach, declared record, portrait, uploaded identity document, signed declaration with date and IP address | Checking identity and eligibility, preventing duplicate or fraudulent registrations, issuing a Fighter ID, licence and certificate, contacting you about your application | Contract (Art. 6(1)(b)) — you ask us to register you; legitimate interests (Art. 6(1)(f)) in the integrity of the ranking and preventing fraud |
| Athletes — sporting record | Bout records, results, methods, events, opponents, evidence files, verification decisions, points, ranks, licence and certificate numbers and status | Verifying results, calculating and publishing rankings, the verify page, movement history and the historical record of the sport | Contract; legitimate interests in a transparent, verifiable world ranking and an accurate historical sporting record |
| Athletes — health and anti-doping (special category) | Medical clearance dates, medical records and notes added to the athlete passport medical vault, medical suspensions, weigh-in results, weight logs, anti-doping test records, results and sanctions, whereabouts (dates, locations, daily windows) | Protecting athlete safety, deciding whether an athlete may compete, running anti-doping controls and enforcing sanctions | Legitimate interests and, for special category data, Art. 9(2)(g) substantial public interest under DPA 2018 Schedule 1 Part 2 paragraph 26 (anti-doping in sport) and paragraph 28 (standards of behaviour in sport); where these do not apply, your explicit consent (Art. 9(2)(a)) given when you upload medical documents. See clause 3 |
| Athletes under 18 and parents/guardians | Parental consent form, the consenting adult's name and contact details | Complying with the Executive Statute (Art. 17) and safeguarding young athletes | Legitimate interests; legal obligation where national law requires consent; DPA 2018 Sch. 1 para 18 (safeguarding) where special category data is involved |
| Account holders (all) | Name, e-mail, password (hashed), role, branch, language, two-factor secret and recovery codes (encrypted), last login time, login events with IP address | Providing accounts, authentication, security, preventing abuse | Contract; legitimate interests in securing the Service |
| Fans | Fighters you follow, notification preferences, predictions, poll votes, quiz results, fantasy teams and scores, premium subscription status | Providing fan features and notifications you ask for | Contract; consent for push notifications |
| KBN Social members | Username, display name, date of birth (encrypted, used for the 18+ check), bio, avatar and cover, disciplines, followers, posts, shorts, stories, comments, likes, saves, groups, direct messages, mentions, notifications, search history you choose to keep, reports you make or receive, moderation history, verification-badge applications including an ID document | Providing the social network, keeping it adults-only, moderation and safety, verification badges | Contract; legitimate interests in a safe, lawful community and in protecting users; legal obligation where we must act on unlawful content |
| Officials and administrators | Name, role, branch, assigned bouts, scores submitted, check-ins, weigh-ins recorded, officials' exam results and licences, all actions taken in the admin area (audit log) | Running events and scoring, accountability, audit and security | Contract or engagement with KBN; legitimate interests in accountable governance |
| Payments and orders | Invoices, order references, amounts, plan, renewal records, ticket orders and QR tickets, provider reference (no card numbers are stored by KBN) | Taking payment, issuing tickets and documents, accounting and tax | Contract; legal obligation (tax and accounting records) |
| Contracts and e-signatures | Bout agreement parties, typed signature, signing time, IP address and browser identifier | Creating and evidencing bout agreements | Contract; legitimate interests in evidencing agreements |
| E-mail campaigns and newsletters | E-mail address, segment, send and open records (a 1×1 open-tracking image), unsubscribe status | Sending news and updates you asked for and measuring whether they are read | Consent (and PECR); you can unsubscribe from every message. Open tracking only with consent — see clause 11 |
| Complaints, appeals, disciplinary and integrity | Your correspondence, case files, hearing records, decisions, integrity alerts about scoring or ranking anomalies; this may include allegations of offences such as match-fixing | Handling complaints and appeals, enforcing the Code of Conduct, protecting the integrity of sport | Legitimate interests; DPA 2018 Sch. 1 para 28 (standards of behaviour in sport) and, for criminal-offence data, Art. 10 with the corresponding Schedule 1 condition |
| Website visitors | IP address, browser and device information, pages requested, a session identifier, a shortened hash of your IP address and a random visitor token used to count unique views and likes on articles and media | Delivering pages, security, rate limiting, preventing fraud and counting unique views | Legitimate interests in running a secure service and honest engagement counts |
| AI and document-reading features | The text or document you submit to an AI feature and the output | Providing the feature you asked for (see AI features notice) | Legitimate interests; contract where you request the feature |
3. Special category and sensitive data
3.1Health and anti-doping information is special category data. We process it only where necessary to protect athlete safety and the integrity of the sport, keep it to the minimum needed, restrict it to authorised roles (medical and anti-doping officers, KBN World HQ and the athlete's branch), and log access. Where we rely on DPA 2018 Schedule 1 we maintain an Appropriate Policy Document [to be confirmed].
3.2The medical vault can hold notes and documents added by medical officers. Athletes can see entries marked visible to them. We do not publish medical information; the public profile and verify page show only whether a licence is active or suspended.
3.3Passport and national ID numbers are encrypted in the database, are never shown publicly and are masked in the admin area (for example ••••1234) unless the administrator holds the specific identity-document permission.
3.4Uploaded documents (identity documents, portraits, evidence, medical files, verification-badge IDs) are stored on a private disk and are served only through authorised, time-limited links; they are never publicly accessible.
↑ Contents4. What we publish
4.1For licensed athletes whose ranking is published we show, as sporting information: name, nickname, country and flag, discipline, category, weight class, verified record, ranking positions and points, club and coach, age, physical statistics and portrait. Applicants appear with an "In review" status and no points.
4.2For athletes under 18 the public profile is limited to name, country and division; portrait, age, physical statistics, club and coach are not published (Executive Statute Art. 17).
4.3The verify page confirms a licence or certificate number, the athlete's name and status and their ranking. It never shows identity documents, contact details or health information.
4.4KBN Social content is visible according to your settings (public or private account, post audience). Your date of birth is never shown to other members.
4.5Public pages can be viewed worldwide and may be copied by third parties outside our control.
↑ Contents5. Where the data comes from
5.1Mostly from you. We also receive data from: the national branch for your country; event organisers, promoters and federations (result sheets, fight cards and confirmations); referees and judges (scores, weigh-ins, results entered in the referee app); medical and anti-doping officers and agencies; clubs and coaches who manage their athletes; other members of KBN Social (for example when they mention you or report content); and bulk imports of historical results from federations, which are verified before they count.
↑ Contents6. Who we share it with
6.1We do not sell personal data and we do not use it for third-party advertising. We share it only as follows:
- KBN World HQ and the national branch for your country. Branch officers see only records of their own country; this is enforced in the software. Whether national branches act as KBN's representatives or as separate controllers for their own national activities is [to be confirmed] and will be stated in the branch's own notice where applicable.
- Event organisers, federations and competent authorities, only to verify a result or document you have submitted, or where the law requires.
- Anti-doping organisations and medical officers appointed for an event or under the Anti-doping & medical policy.
- Hosting and infrastructure: DigitalOcean (servers, databases, file storage and backups) — hosting location [to be confirmed].
- E-mail delivery provider for account and application e-mails [to be confirmed].
- Anthropic PBC for AI features, only when they are switched on and only with the data described in the AI features notice.
- Payment providers (for example Stripe, when enabled) to take payments; they receive card details directly from you.
- Push notification services run by your browser vendor (for example Google, Mozilla or Apple) deliver encrypted notifications if you enable push.
- Google Fonts receives your IP address when your browser downloads the site's fonts; YouTube receives data when you play an embedded video.
- Professional advisers, insurers, courts, regulators and law enforcement where necessary to establish, exercise or defend legal claims or to comply with law.
- A successor organisation if the operation of the Service is transferred, subject to this notice.
6.2All processors act under written contracts that require them to protect the data and use it only on our instructions.
↑ Contents7. International transfers
7.1The Service's servers are hosted at [to be confirmed]. If DigitalOcean Spaces object storage is used for private files and backups, files are stored in the configured Spaces region (the default configuration uses the "ams3" region; the production region is [to be confirmed]).
7.2Some providers (for example Anthropic, DigitalOcean, Google and payment providers) are based in or may access data from the United States or other countries. Where personal data leaves the UK we rely on UK adequacy regulations (for example for the EEA, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. The mechanism for each provider is [to be confirmed].
7.3KBN is an international federation. When your national branch is outside the UK, your records are accessed from that country so that the branch can review your application. Public ranking pages are, by their nature, available worldwide.
↑ Contents8. How long we keep it
8.1We keep personal data only as long as needed for the purposes above. The full schedule is in the Data retention schedule. In summary: rejected applications are deleted automatically after the retention period set by KBN (currently 365 days); verification-badge ID documents are deleted once a decision is made; stories disappear after 24 hours unless added to a highlight; licence records are kept for the life of the licence plus six years; and the verified sporting record (names, results and rankings) is kept as the permanent historical record of the federation.
↑ Contents9. Automated calculation and decision-making
9.1Ranking points and positions are calculated automatically by the KBN ranking engine from verified results using the published formula in the Ranking regulations (base points × event multiplier × time value, then sorted by points, verified wins and surname). Whether a result is verified, which level an event has and whether a licence is issued or suspended are always decided by people (the national branch and the KBN Ranking Committee), not by the software.
9.2Because rankings can affect eligibility for events and titles, you have the right to ask for a human review of any calculation or position, to express your point of view and to contest it. Write to the Ranking Committee under the Complaints & appeals procedure; we will check the inputs and the calculation and correct any error.
9.3Other automated tools only assist people: integrity alerts flag unusual scorecards or ranking changes for human review; the KBN Social content filter masks swear words and blocks certain usernames; and AI features produce drafts only (see AI features notice). None of them makes a decision with legal or similarly significant effects about you.
↑ Contents10. How we protect it
10.1We use encryption in transit (HTTPS with HSTS), encryption at rest for identity numbers, dates of birth on KBN Social and two-factor secrets, role- and branch-based access control enforced on the server, two-factor authentication for administrators, rate limiting, private file storage with signed and time-limited links, an audit trail of every state change, and nightly backups. More detail is in the Security & vulnerability disclosure. No system is perfectly secure; if a breach is likely to put your rights at high risk we will tell you without undue delay.
↑ Contents11. E-mails, notifications and tracking
11.1We send service e-mails you need (for example e-mail verification, application stage changes, requests for documents, licence and certificate issuance). You cannot opt out of these while you have an active account or application.
11.2News, newsletters and campaign e-mails are sent only with your consent, and every one contains an unsubscribe link. Campaign e-mails can contain a 1×1 image that records whether and when the e-mail was opened. Under the Privacy and Electronic Communications Regulations this requires your consent; we use it only for recipients who have agreed, and you can block it by turning off automatic image loading in your e-mail client.
11.3Push notifications are sent only if you switch them on in the app, and you can switch them off at any time in the app or your browser settings.
11.4Our use of cookies and browser storage is explained in the Cookie policy.
↑ Contents12. Children
12.1Fan accounts are for people aged 16 and over; KBN Social is for adults aged 18 and over. If an under-18 tries to join KBN Social we do not save their details. If you believe a child has an account, contact us and we will remove it.
12.2Athletes under 18 can be registered for the ranking only with the documented consent of a parent or legal guardian, and their public profile is restricted as described in clause 4.2. See the Safeguarding & minors policy.
↑ Contents13. Your rights
13.1Under UK GDPR you have the right to: be informed; access your personal data; have inaccurate data rectified; have data erased; restrict processing; data portability; object to processing based on legitimate interests (including profiling); and not be subject to solely automated decisions with legal or similarly significant effects. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
13.2Some rights are limited. For example, we may keep the verified sporting record (results and rankings) where we have compelling legitimate grounds as the historical record of the sport, and we may keep data needed for legal claims, sanctions, safeguarding or legal obligations. We will explain any refusal.
13.3How to exercise your rights: see Data subject requests. We respond within one month, extendable by up to two further months for complex requests, and requests are free unless manifestly unfounded or excessive.
↑ Contents14. Complaints
14.1Please contact us first at holdingkbn@gmail.com so we can try to resolve your concern.
14.2You have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you live outside the UK you may also complain to your local data-protection authority.
↑ Contents15. Changes to this notice
15.1We update this notice when our processing changes. The version and "Last updated" date appear at the top. We will tell registered users about material changes by e-mail or in the app.
↑ ContentsQuestions about this document: holdingkbn@gmail.com. Where this document is translated, the English version prevails to the extent permitted by law. Version 2.0, last updated 28 September 2026. Printed copies may be out of date; the version at worldkbn.com/legal/privacy applies.